Skip to main content
Tensor9 BYOC lets each of your customers pick how their end users reach the deployed application. The choice is configuration, not source code: your same origin stack compiles into a deployment stack shaped to whatever posture the customer selects. The URL their end users type stays the same regardless of which option they pick; only the network path changes. Three ingress options: Public (default), Allowlist (CIDR-gated), and Tailscale (tailnet only). The customer picks one at appliance setup time. Three ingress options: Public (default), Allowlist (CIDR-gated), and Tailscale (tailnet only). The customer picks one at appliance setup time.

​
Ingress options

​
Configuring an option

Ingress posture is set on the form factor you author. The form factor declares which of the three options it permits; your customer (or you on their behalf) picks from those permitted options at appliance setup time.
  • Public, Allowlist, and Tailscale are mechanical: declare them in the form factor, configure the customer’s specifics (the allowlist CIDRs, or the Tailscale auth key) in the appliance setup link, and the compiler emits the right deployment stack.
The customer-facing version of this summary lives at Private ingress for customers who land directly on that page.

​
How this fits into the bigger network picture

This page is the customer-customizable knob for application ingress, the link end users traverse to reach the deployed application. Tensor9 BYOC manages three other network links (operator-to-control-plane, appliance-to-control-plane, and break-glass) that are your-side concerns or covered separately. The full architectural view is on Connectivity; the customer-customizable subset (this page + Controller Connectivity) is what shows up in this section.